ACCC privacy push 'potential nightmare' for Google, Facebook

What if Google and Facebook had to specifically ask permission for each piece of data it collects on us and it had to do so in a way a child could understand?

It would make a change from, as the competition regulator describes, "long, complex, vague and difficult to navigate" privacy policies. Consumers might cheer, but it could cause a raft of problems well beyond the Silicon Valley giants.

Facebook and Google were the main targets of the ACCC inquiry, but other businesses will be impacted. Bloomberg

The Australian Competition and Consumer Commission made global first recommendations on how to rein in the market power of the digital giants, such as a regulator with oversight over algorithms. But beneath the headline-grabbing calls lurks a potential overhaul of data and privacy regulation that could have far-ranging implications beyond the so-called technology duopoly.

It's hard to argue users should not have greater control over their personal data and be able to access products without handing as much over as they already do.

Advertisement

Data, and its ability to categorise users by gender and age, not to mention its increasing accuracy on marital status, stage of pregnancy, voting intentions or your likelihood of needing a new toothbrush, has been at the centre of Google and Facebook's rise to digital dominance.

By building accurate psychological profiles of its users, the pair can charge advertisers a higher price to ensure their ads are being seen by the potential consumers most likely to act on them. Last quarter the pair combined took in $US42.7 billion ($59.4 billion) in advertising revenue.

But it's not just the social network and search giant that have realised data is a valuable commodity. Slowly but surely supermarkets, airlines and clothing stores have begun collecting data on their customers to better target them with advertising.

So too have media businesses, which means if suddenly consumers must expressly consent to having their data collected for targeted advertising, their lobbying for tighter controls on Facebook on Google could come back to bite them.

ACCC chair Rod Sims revealed the most extensive report into Google and Facebook's dominance done across the globe. Peter Rae

What opting-in could mean

In essence, what the so-called expressed opt-in consent could mean for a Facebook user logging in for the first time, or a Coles online shopper opening an account, is a a requirement to say "yes" to the collection of different types of data for targeted advertising. It must also be explained it layman's terms.

Mills Oakley partner Kathryn Edghill said it is a sleeper recommendation. "It's tip-of-the-iceberg stuff," she says. "I see it as a potential nightmare, especially for smaller businesses and advertisers who collect a bit of data."

Advertisement

In reality, Edghill says it remains unclear exactly how such changes will work in practice. Both the ACCC and government are usually loathe to create industry-specific legislation.

"Logically, to me, it seems it would be veryhard to confine that to specific digital platforms. Its flow-on effects possibly haven't been thought through."

The ACCC inquiry has recommended a crackdown on tech giants Google and Facebook. Andrew Harrer

Edghill says writing a privacy policy which is easy for the general public to understand but stands up legally is not a simple task. People are waking up to the fact the value exchange between Google, Facebook and the consumer, up to this point, has been unfairly weighted. There is a line and there is now a view Google and Facebook have crossed it and taken too much information about individuals.

"That's the difficulty for regulation. It's identifying the line then putting it into some regulation or law. It's very hard," she says.

Australians are growing more sceptical of data collection and are realising the power of their personal information which they have, until recently, handed over without a second thought.

Australians were highly critical of a government decision to automatically opt-in citizens to My Health Record and, as of September, nearly 1 million had opted out, or about 3 per cent of the country, due to fears over how their private health data would be stored and used.

Advertisement

Facebook and Google's amazing success has largely been off the scale they have achieved. According to the ACCC, in Australia alone, 19 million Australians access Google every month. About 17 million access Facebook, 17 million use YouTube (owned by Google) and about 11 million are on Instagram (owned by Facebook).

So for all the unintended consequences that might stem to other industries, it is still Facebook and Google that have the most to lose.

'Privacy-intrusive selections'

Sims says the public are largely unaware of how deep, and at times creepy, the duopoly burrow into our personal lives. It goes well beyond what we openly share, and that consumers are misled in terms of how much control they have over what is collected about them.

"The source of Google's power, and Facebook's too, is their ability to use data outside of consumer expectations," Jason Kint, CEO of US trade association Digital Content Next says.

Google CEO Sundar Pichai appears before the US House Judiciary Committee to be questioned about the internet giant's privacy security and data collection.

"No one would question Google using your data when you search to provide you more relevant ads and no one would question Google using your location when you're using Google Maps to let you know where you're going and where you are. It's the marrying of the two and where they take that data and use it across the web, or across your experiences and out of context, that surprise the user."

In March, Facebook admitted it had been collecting call and text message data from Android operating system phones, something the social media network said was part of an opt-in feature for people using its Messenger app.

Advertisement

It was a case of bundled consent for users who opted in allowing Facebook to import their contacts, but many did not not realise they were handing over their call and text records.

Bundled consent and take-it-or-leave it terms make it hard for users to understand what exactly they are signing over and market dominance means there are few alternatives.

"When you ask the user for that permission, they're not likely to give it to you," Kint says.

While Facebook and Google have faced new data privacy regulation in the European Union via the General Data Privacy Regulation, both employ techniques to push users towards opting in.

"Digital platforms may also design user interfaces that lead users to make privacy-intrusive selections by appealing to certain psychological or behavioural biases," the ACCC report says.

"These include using default settings to opt-in users to certain types of data collection or pre-selecting options in ways that may nudge users towards more privacy-intrusive choices."

Facebook CEO Mark Zuckerberg testified before a House Energy and Commerce hearing on Capitol Hill in Washington in April. Andrew Harnik

It's true consumers are given the option to opt out of having their data harvested, but unless individuals take that step to actively stop Google and Facebook collecting information about them for targeted advertising, they automatically do so.

Advertisement

Potential changes would have massive implications for the way Facebook and Google go about their business. Without intimate knowledge of individuals, Facebook and Google's advertising proposition loses its potency.

"It does strike at the heart of the business models of Facebook and Google, but that's the world we live in now," Deloitte partner Peter Corbett says. "It's also a little bit about the industry and sector and catching up."

Research undertaken by Deloitte found 84 per cent of Australians are concerned about how companies use, store and share their personal data and 76 per cent of smartphone users believe companies share their personal data with third parties most of the time.

"What really comes out is this idea of the cornered consumer. You want the best search but you have to comply with the terms and conditions, there is no alternative. It's the privacy paradox," Corbett says.

Corbett says Australians are concerned about how there data is being used, but they're not acting on it, with 52 per cent of Australians not reading terms and conditions from companies like Google, Facebook, Apple and Amazon. Australians are concerned, but they're more concerned about the utility of companies like Google and Facebook.

Morphic Asset Management head of research James Tayler says the implications for Google and Facebook are few in the short term, but new regulation in Australia could provide a blueprint for other markets.

"They are global beasts and Australia is relatively small in terms of revenue and profitability. However, well thought-out engagement between regulators here and the companies will increase the chance that the companies think and act in a sincere way," he says.

Advertisement

"After all, as these are issues that will likely be raised elsewhere they will likely work out that it is in their interests to work on sensible mutually acceptable outcomes. These can then be 'copy pasted' into other regulatory regimes overseas. The cost of this to the companies is probably small in the short term, however, effective regulation should lead to the erosion of the super normal profits that they currently earn."

Tayler says while the companies are trading on massive valuations, Facebook shares have tanked 33.3 per cent since the year's high in July. The regulation could become a growing problem for them depending on how the other aspects of their businesses pan out.

Ad revenue is the life blood of both companies. Of Google's third quarter revenue of $US33.7 billion, $US29 billion came from advertising. For Facebook, $US13.5 billion of its $US13.7 billion in revenue in the quarter was advertising.

"User data helps us serve relevant ads, and these ads help fund our services and make them free for everyone. We've long understood that users want transparency, choice and control about the data they share and how it can be used," a Google spokeswoman says.

"Google's privacy policy explains what information we collect, why we collect it, and how users can update, manage, export, and delete their information. Google gives users control of how their data is being used by Google through the MyAccount website. In 2017, Australians visited MyAccount.google.com more than 22 million times."